CVE-2022-30275 json
The Motorola MOSCAD Toolbox software through 2022-05-02 relies on a cleartext password.
published 2022-07-26 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-52230
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
The Motorola MOSCAD Toolbox software through 2022-05-02 relies on a cleartext password. It utilizes an MDLC driver to communicate with MOSCAD/ACE RTUs for engineering purposes. Access to these communications is protected by a password stored in cleartext in the wmdlcdrv.ini driver configuration file. In addition, this password is used for access control to MOSCAD/STS projects protected with the Legacy Password feature. In this case, an insecure CRC of the password is present in the project file: this CRC is validated against the password in the driver configuration file.
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
cisa ICSA-22-179-05 updated cvss 7.5
Motorola Solutions MDLC
-
Motorola Solutions MDLC 4.80.0024, 4.82.004, 4.83.001affected: vendor fix, mitigation “For user guide and procedural information mentioned within this report, use the Contact Us form and select “Other” for Product Interest and request the manual for IoT products.” motorolasolutions.com
From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf
Exploit prediction
0.60% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Classification
- Weakness
-
- CWE-312 Cleartext Storage of Sensitive Information
References
-
forescout.com
/blog/
third-party-advisory
-
cisa.gov
/uscert/ics/advisories/icsa-22-179-05
mitigation, third-party-advisory, us-government-resource
Sources
- CVE List CVE-2022-30275
- NVD CVE-2022-30275
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.